WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments
WordPress patched CVE-2026-93485, a stored XSS called Comment2Shell that can lead to admin-triggered command execution.
5
Stories per day · 30 days
1 RSS
2 stories, newest first · one card per story
Stories tagged #comment2shell
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
A crafted comment (Comment2Shell) allowed an attacker to run code on the server via a line break in an HTML attribute. Another flaw, Click2Shell, enabled theme installation and further code execution. WordPress has had…
1